N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-2fcv-qww3-9v6h

GHSA-2fcv-qww3-9v6h: Babylon's malformed vote extensions are not rejected

Summary

Adversarial validators can send large vote extensions by using non-existing protobuf tags. This will result in the rejection of the subsequent block proposal. Eventually, all block proposals will be rejected by all validators.

Impact

A small group of adversarial validators can cause a chain halt.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-2fcv-qww3-9v6h

GHSA-2fcv-qww3-9v6h:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/babylonlabs-io/babylon/v4	go	< 4.1.0	4.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security advisory and the associated patch commit pinpoints the vulnerability to the verifyVoteExtension function in x/checkpointing/prepare/proposal.go. The vulnerability description highlights that malformed vote extensions with non-existing protobuf tags were not being rejected, allowing for a denial-of-service attack. The commit 86f38abd2dca5a656195a9954bb569a08d662e2b directly addresses this issue. The core of the fix is the addition of unknownproto.RejectUnknownFieldsStrict within the verifyVoteExtension function. This function is responsible for processing vote extensions, and prior to the patch, it lacked the necessary validation to detect and reject protobuf messages containing unknown fields. This allowed an attacker to embed arbitrary data, leading to oversized vote extensions that would cause subsequent block proposals to fail, ultimately halting the blockchain. The new code ensures that any such malformed vote extensions are rejected early, mitigating the vulnerability. The accompanying test file changes also confirm this by adding a specific test case for a malicious oversized vote extension.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.