N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-56j4-446m-qrf6

GHSA-56j4-446m-qrf6: Babylon vulnerable to chain half when transaction has fees different than `ubbn`

Summary

Sending transactions with fees different than native Babylon genesis denom (ubbn) leads to chain halt.

Impact

Denial of Service - Due to panic in the x/distribution module BeginBlocker triggered by a error when sending fees from feeCollector to x/distribution module - https://github.com/cosmos/cosmos-sdk/blob/main/x/distribution/keeper/allocation.go#L28 Babylon Genesis will halt

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-56j4-446m-qrf6

GHSA-56j4-446m-qrf6:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/babylonlabs-io/babylon/v2	go	< 2.2.0	2.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper handling of transaction fees with denominations other than the native ubbn. The root cause is a missing check in the bankSendRestrictionOnlyBondDenomToDistribution function, which is responsible for restricting which token denominations can be sent to specific module accounts. The original implementation only protected the distribution module account, but not the feeCollector account. This allowed the feeCollector to accumulate fees in non-native denominations. The chain would then halt when the distribution module's BeginBlocker attempted to process these invalid fees, triggering a panic. The fix was to extend the restriction in bankSendRestrictionOnlyBondDenomToDistribution to also cover the feeCollector account, thus preventing the invalid fees from entering the system in the first place. The identified vulnerable function is the pre-patch version of bankSendRestrictionOnlyBondDenomToDistribution as it contained the logic that failed to prevent the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.