nimiq-account CVE-2026-34064

The vulnerability exists in the VestingContract::can_change_balance method within nimiq-account, a Rust crate used by Nimiq's blockchain node software. Vesting contracts are created with 32-byte encoded data that specifies a total_amount parameter, but this value is never validated against the actual contract balance (transaction value). When an attacker creates such a contract with total_amount > actual_balance and later attempts to trigger an outgoing transaction, the error handling path attempts to construct an AccountError::InsufficientFunds error by computing balance: self.balance - min_cap. Because min_cap > balance in the attacker-controlled state, the Coin::sub operation underflows and panics, crashing the node during mempool admission or block processing. This is a CWE-191 (Integer Underflow) flaw masked as error handling logic.