GHSA-869w-47c6-fq8q

Source

https://github.com/advisories/GHSA-869w-47c6-fq8q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-869w-47c6-fq8q/GHSA-869w-47c6-fq8q.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-869w-47c6-fq8q

Aliases

GO-2025-3687

Published

2025-05-15T14:05:50Z

Modified

2025-05-15T20:57:03.307897Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt

Details

Summary

Minting large amount of tokens through ibc transfer and then depositing them in validator rewards pool (via DepositValidatorRewardsPool message) can lead to integer overflow panic when calculating cumulative_reward_ratio for the validator.

This calculation happens in x/epoching module EndBlocker, thus the panic will halt the chain.

Impact

Denial of Service - Due to panic in the EndBlocker Babylon Genesis will halt

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-190",
        "CWE-770"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-15T14:05:50Z"
}

References

Affected packages

Go / github.com/babylonlabs-io/babylon

Package

Name: github.com/babylonlabs-io/babylon; View open source insights on deps.dev
Purl: pkg:golang/github.com/babylonlabs-io/babylon

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.0.2