GHSA-4jmp-x7mh-rgmr
Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration
GHSA-4jmp-x7mh-rgmr is a high vulnerability (CVSS 8.7) in github.com/babylonlabs-io/finality-provider, published December 12, 2025. No source lists public exploit code. Fixed in github.com/babylonlabs-io/finality-provider 1.0.4.
- Severity
- 8.7 HighCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.0.4github.com/babylonlabs-io/finality-provider +8 more
Description
Summary
The anti-slashing is not effective if the attacker can access EOTS manager endpoints.
Impact
If the EOTS manager endpoints are open to public without HMAC protection, the attacker can manually cause slashing of the finality provider through the RPC endpoints.
Report credits go to: x.com/RebelsRunways
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/babylonlabs-io/finality-providerGo | through 1.0.3 | 1.0.4 |
github.com/babylonlabs-io/finality-providerGo | 1.1.0-rc.0 to 1.1.0-rc.0 | None known |
github.com/babylonlabs-io/finality-providerGo | 1.1.0-rc.1 to 1.1.0-rc.1 | None known |
github.com/babylonlabs-io/finality-providerGo | 1.99.0-devnet.6 to 1.99.0-devnet.6 | None known |
github.com/babylonlabs-io/finality-providerGo | before 1.0.4 | 1.0.4 |
github.com/babylonlabs-io/finality-providerGo | Listed versions 1.1.0-rc.0 | None known |
github.com/babylonlabs-io/finality-providerGo | Listed versions 1.1.0-rc.1 | None known |
github.com/babylonlabs-io/finality-providerGo | Listed versions 1.99.0-devnet.6 | None known |
github.com/babylonlabs-io/finality-providerGo | All versions | None known |
What each source reports
GitHub Advisories Score used
Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration
Summary
The anti-slashing is not effective if the attacker can access EOTS manager endpoints.
Impact
If the EOTS manager endpoints are open to public without HMAC protection, the attacker can manually cause slashing of the finality provider through the RPC endpoints.
Report credits go to: x.com/RebelsRunways
- Record
GHSA-4jmp-x7mh-rgmr- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-285
- Updated
- 2026-11-02
OSV
Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration
Summary
The anti-slashing is not effective if the attacker can access EOTS manager endpoints.
Impact
If the EOTS manager endpoints are open to public without HMAC protection, the attacker can manually cause slashing of the finality provider through the RPC endpoints.
Report credits go to: x.com/RebelsRunways
- Record
GHSA-4jmp-x7mh-rgmr- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-285
- Updated
- 2026-11-02
OSVGO-2025-4236No score
Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration in github.com/babylonlabs-io/finality-provider
Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration in github.com/babylonlabs-io/finality-provider
- Record
GO-2025-4236- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.