GHSA-869w-47c6-fq8q
Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt
GHSA-869w-47c6-fq8q is a high vulnerability (CVSS 8.2) in github.com/babylonlabs-io/babylon, published May 15, 2025. No source lists public exploit code. Fixed in github.com/babylonlabs-io/babylon 1.1.0.
- Severity
- 8.2 HighCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.1.0github.com/babylonlabs-io/babylon +1 more
Description
Summary
Minting large amount of tokens through ibc transfer and then depositing them in validator rewards pool (via DepositValidatorRewardsPool message) can lead to integer overflow panic when calculating cumulative_reward_ratio for the validator.
This calculation happens in x/epoching module EndBlocker, thus the panic will halt the chain.
Impact
Denial of Service - Due to panic in the EndBlocker Babylon Genesis will halt
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/babylonlabs-io/babylonGo | before 1.1.0 | 1.1.0 |
github.com/babylonlabs-io/babylonGo | All versions | None known |
What each source reports
GitHub Advisories Score used
Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt
Summary
Minting large amount of tokens through ibc transfer and then depositing them in validator rewards pool (via DepositValidatorRewardsPool message) can lead to integer overflow panic when calculating cumulative_reward_ratio for the validator.
This calculation happens in x/epoching module EndBlocker, thus the panic will halt the chain.
Impact
Denial of Service - Due to panic in the EndBlocker Babylon Genesis will halt
- Record
GHSA-869w-47c6-fq8q- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-190, CWE-770
- Updated
- 2026-11-02
OSV
Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt
Summary
Minting large amount of tokens through ibc transfer and then depositing them in validator rewards pool (via DepositValidatorRewardsPool message) can lead to integer overflow panic when calculating cumulative_reward_ratio for the validator.
This calculation happens in x/epoching module EndBlocker, thus the panic will halt the chain.
Impact
Denial of Service - Due to panic in the EndBlocker Babylon Genesis will halt
- Record
GHSA-869w-47c6-fq8q- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-190, CWE-770
- Updated
- 2026-11-02
OSVGO-2025-3687No score
Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt in github.com/babylonlabs-io/babylon
Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt in github.com/babylonlabs-io/babylon
- Record
GO-2025-3687- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.