-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/babylonlabs-io/finality-provider | go | <= 1.0.3 |
Miggo AIRoot Cause AnalysisThe vulnerability analysis of babylonlabs-io/finality-provider commit 721bf5b7a271ada1679a67496c9bc3516c339390 reveals two distinct but related security issues that were addressed.
First, the advisory highlights that the anti-slashing mechanism could be bypassed. The root cause was the UnsafeSignEOTS RPC endpoint, which, as its name implies, does not enforce slashing protection. This endpoint was enabled by default and, if exposed without proper HMAC authentication, would allow an attacker to submit signing requests that could lead to the finality provider being slashed. The patch mitigates this by introducing a new configuration option, DisableUnsafeEndpoints, which is set to true by default, effectively disabling this dangerous endpoint unless explicitly enabled for testing or other specific purposes.
Second, the patch addresses a key aliasing vulnerability within the LocalEOTSManager. The SignEOTS and its helper function getEOTSPrivKey were flawed. An attacker could associate their own public key with a victim's key name in the system. When a signing request was made with the attacker's public key, the system would resolve it to the victim's key name, retrieve the victim's private key, and sign the attacker's message. The vulnerability existed because the code did not verify that the public key in the signing request matched the public key corresponding to the private key retrieved from the keyring. The fix involves adding an explicit verification step after key retrieval to ensure the public keys match, thus preventing this impersonation attack.
Both vulnerabilities could lead to unauthorized signing operations and financial loss through slashing. The identified vulnerable functions are the ones that either directly exposed the unsafe operation (UnsafeSignEOTS) or contained the flawed logic that allowed for key aliasing (SignEOTS, getEOTSPrivKey).
service.rpcServer.UnsafeSignEOTSeotsmanager/service/rpcserver.go
eotsmanager.LocalEOTSManager.SignEOTSeotsmanager/localmanager.go
eotsmanager.LocalEOTSManager.getEOTSPrivKeyeotsmanager/localmanager.go