The vulnerability exists in the nimiq-blockchain Rust implementation, specifically in the block timestamp validation logic. While the code enforces that timestamps for non-skip blocks are greater than or equal to the parent block's timestamp and that skip blocks have timestamps exactly equal to the parent's timestamp plus a minimum producer timeout, it does not enforce an upper bound relative to the actual wall clock time. This flaw enables a malicious validator to assign future timestamps to blocks, which manipulates reward calculations in the Policy::supply_at() and batch_delay() functions, resulting in an unintended inflation of the blockchain's monetary supply.

The impact is a high-severity inflation of the blockchain's monetary supply due to manipulated block timestamps. This compromises the integrity of the emission schedule and could undermine economic trust in the Nimiq blockchain. There is no direct confidentiality or availability impact reported. No known exploits in the wild have been identified at this time.

Patch status is not yet confirmed — no official fix or vendor advisory is currently available. Users should monitor the vendor's advisory channels for updates and apply any forthcoming patches promptly. Until a fix is released, restricting block-producing validators to trusted parties and monitoring for anomalous block timestamps could help mitigate risk.