Viquezclaudio

**Name of the Vulnerable Software and Affected Versions** Nimiq versions prior to 1.5.1 **Description** The validity store uses a strict lower-bound comparison that expires stored transactions too early relative to the `Transaction::is valid at` function. This occurs because the store treats a transaction with `block number = X` as being within the window only when `X > last bn - transaction validity window blocks`. A remote attacker can exploit this by choosing a specific `validity start height` to replay a signed transaction within a window of `blocks per batch` minus one block. This results in the transaction being executed twice, causing the sender to be debited twice and the recipient to be credited twice. **Recommendations** Update to version 1.5.1.