GHSA-4rmq-mc2c-r495
Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond
Summary
A state consistency bug in x/costaking can leave a BTC delegator with non-zero ActiveSatoshis (Phatom Stake) even after they have fully unbonded their BTC delegation, if their Finality Provider (FP) drops out of the active set in the exact same babylon block height. This creates a “phantom stake”: the delegator’s BTC capital is withdrawn, the FP is inactive, but costaking continues to treat the delegation as active BTC stake allowing ongoing rewards accrual without backing BTC.
Impact
An address can keep earning costaking rewards with zero BTC staked.
Reported by @BottyBott.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond
Summary
A state consistency bug in x/costaking can leave a BTC delegator with non-zero ActiveSatoshis (Phatom Stake) even after they have fully unbonded their BTC delegation, if their Finality Provider (FP) drops out of the active set in the exact same babylon block height. This creates a “phantom stake”: the delegator’s BTC capital is withdrawn, the FP is inactive, but costaking continues to treat the delegation as active BTC stake allowing ongoing rewards accrual without backing BTC.
Impact
An address can keep earning costaking rewards with zero BTC staked.
Reported by @BottyBott.
- Record
GHSA-4rmq-mc2c-r495- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-459
- Updated
- 2026-11-02
OSV
Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond
Summary
A state consistency bug in x/costaking can leave a BTC delegator with non-zero ActiveSatoshis (Phatom Stake) even after they have fully unbonded their BTC delegation, if their Finality Provider (FP) drops out of the active set in the exact same babylon block height. This creates a “phantom stake”: the delegator’s BTC capital is withdrawn, the FP is inactive, but costaking continues to treat the delegation as active BTC stake allowing ongoing rewards accrual without backing BTC.
Impact
An address can keep earning costaking rewards with zero BTC staked.
Reported by @BottyBott.
- Record
GHSA-4rmq-mc2c-r495- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-459
- Updated
- 2026-11-02
OSVGO-2025-4214No score
Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond in github.com/babylonlabs-io/babylon
Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond in github.com/babylonlabs-io/babylon
- Record
GO-2025-4214- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/babylonlabs-io/babylon/v4Go | before 4.2.0 | 4.2.0 |
github.com/babylonlabs-io/babylon/v3Go | through 3.0.0-snapshot.250805a | None known |
github.com/babylonlabs-io/babylon/v2Go | through 2.3.2 | None known |
github.com/babylonlabs-io/babylonGo | through 1.1.0 | None known |
github.com/babylonlabs-io/babylonGo | All versions | None known |
github.com/babylonlabs-io/babylon/v2Go | All versions | None known |
github.com/babylonlabs-io/babylon/v3Go | All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-4rmq-mc2c-r495 is a medium vulnerability (CVSS 6.9) in github.com/babylonlabs-io/babylon/v4, published December 9, 2025. No source lists public exploit code. Fixed in github.com/babylonlabs-io/babylon/v4 4.2.0.