Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-4rmq-mc2c-r495

Опубликовано: 09 дек. 2025
Источник: github
Github: Прошло ревью
CVSS4: 6.9

Описание

Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond

Summary

A state consistency bug in x/costaking can leave a BTC delegator with non-zero ActiveSatoshis (Phatom Stake) even after they have fully unbonded their BTC delegation, if their Finality Provider (FP) drops out of the active set in the exact same babylon block height. This creates a “phantom stake”: the delegator’s BTC capital is withdrawn, the FP is inactive, but costaking continues to treat the delegation as active BTC stake allowing ongoing rewards accrual without backing BTC.

Impact

An address can keep earning costaking rewards with zero BTC staked.

Reported by @BottyBott.

Пакеты

Наименование

github.com/babylonlabs-io/babylon/v4

go
Затронутые версииВерсия исправления

< 4.2.0

4.2.0

Наименование

github.com/babylonlabs-io/babylon/v3

go
Затронутые версииВерсия исправления

<= 3.0.0-snapshot.250805a

Отсутствует

Наименование

github.com/babylonlabs-io/babylon/v2

go
Затронутые версииВерсия исправления

<= 2.3.2

Отсутствует

Наименование

github.com/babylonlabs-io/babylon

go
Затронутые версииВерсия исправления

<= 1.1.0

Отсутствует

6.9 Medium

CVSS4

Дефекты

CWE-459

6.9 Medium

CVSS4

Дефекты

CWE-459