The nimiq-transaction Rust implementation prior to version 1.3.0 contains a cryptographic signature verification flaw (CWE-347) in its staking contract. When processing UpdateValidator transactions, the contract accepts a new voting key without requiring the corresponding proof of knowledge, which is necessary to prevent BLS rogue-key attacks during aggregation of validator voting keys. Because Tendermint macro block justification verification aggregates these keys and verifies a single aggregated BLS signature, a rogue voting key can allow an attacker to forge a quorum justification with only one signature. The vulnerability is mitigated by fixing the contract logic in version 1.3.0. Exploitability is low due to the unpredictability of the next epoch validator set chosen via VRF.

The vulnerability allows an attacker to forge a quorum-looking justification by exploiting the lack of proof-of-knowledge verification for new voting keys in the staking contract. This could undermine the integrity of the consensus process by enabling unauthorized validator signatures. However, the exploitability is low because the attacker must predict the next epoch validator set, which is selected through a secure VRF mechanism. There are no known exploits in the wild.

Upgrade to nimiq-transaction version 1.3.0 or later, where this vulnerability is fixed. No official workarounds are available. Since the vendor has not provided a specific advisory or patch link, verify the upgrade path through official nimiq release channels to ensure the fix is applied.