N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-4rmq-mc2c-r495

GHSA-4rmq-mc2c-r495: Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond

Summary

A state consistency bug in x/costaking can leave a BTC delegator with non-zero ActiveSatoshis (Phatom Stake) even after they have fully unbonded their BTC delegation, if their Finality Provider (FP) drops out of the active set in the exact same babylon block height. This creates a “phantom stake”: the delegator’s BTC capital is withdrawn, the FP is inactive, but costaking continues to treat the delegation as active BTC stake allowing ongoing rewards accrual without backing BTC.

Impact

An address can keep earning costaking rewards with zero BTC staked.

Reported by @BottyBott.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-4rmq-mc2c-r495

GHSA-4rmq-mc2c-r495:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/babylonlabs-io/babylon/v4	go	< 4.2.0	4.2.0
github.com/babylonlabs-io/babylon/v3	go	<= 3.0.0-snapshot.250805a
github.com/babylonlabs-io/babylon/v2	go	<= 2.3.2
github.com/babylonlabs-io/babylon	go	<= 1.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security advisory and the associated patch commit e65c3a55a398a403103f1b089cf76f0d4befc7a0 points to a logic flaw in the x/costaking module of the Babylon chain. The root cause of the vulnerability is an incorrect state update when a BTC delegation is unbonded at the same time as its associated Finality Provider (FP) becomes inactive.

The vulnerable function is HookFinality.AfterBtcDelegationUnbonded located in x/costaking/keeper/hooks_finality.go. The original implementation contained a faulty condition (if !isFpActiveInPrevSet || !isFpActiveInCurrSet) that prevented the subtraction of staked satoshis (ActiveSatoshis) from a delegator's account if the FP was active in the previous block but inactive in the current block. This scenario allowed the delegator's account to maintain a non-zero ActiveSatoshis balance, or "phantom stake," even after their BTC was fully unbonded, leading to undue reward accrual.

The patch corrects this by changing the condition to if !isFpActiveInPrevSet. This ensures that as long as the FP was active in the block preceding the unbonding event, the delegator's ActiveSatoshis are correctly reduced, regardless of the FP's status in the current block. This prevents the creation of phantom stake. The patch also introduces an upgrade handler (ResetCoStakerRwdsTracker) to retroactively fix the state of any accounts that were affected by this bug.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.