{"id":"GHSA-4jmp-x7mh-rgmr","aliases":["GO-2025-4236"],"status":"published","title":"Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration","description":"### Summary\n\nThe anti-slashing is not effective if the attacker can access EOTS manager endpoints.\n\n### Impact\n\nIf the EOTS manager endpoints are open to public without HMAC protection, the attacker can manually cause slashing of the finality provider through the RPC endpoints.\n\nReport credits go to: x.com/RebelsRunways","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285"],"published":"2025-12-12T20:15:03Z","modified":"2026-03-03T04:57:48Z","fixes":[{"ecosystem":"Go","package":"github.com/babylonlabs-io/finality-provider","fixed_in":["1.0.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/babylonlabs-io/finality-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.3"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/babylonlabs-io/finality-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0-rc.0"},{"last_affected":"1.1.0-rc.0"}]}],"versions":["1.1.0-rc.0"]},{"source":"ghsa","ecosystem":"Go","package":"github.com/babylonlabs-io/finality-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0-rc.1"},{"last_affected":"1.1.0-rc.1"}]}],"versions":["1.1.0-rc.1"]},{"source":"ghsa","ecosystem":"Go","package":"github.com/babylonlabs-io/finality-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.99.0-devnet.6"},{"last_affected":"1.99.0-devnet.6"}]}],"versions":["1.99.0-devnet.6"]},{"source":"osv","ecosystem":"Go","package":"github.com/babylonlabs-io/finality-provider","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/babylonlabs-io/finality-provider","versions":["1.1.0-rc.0"]},{"source":"osv","ecosystem":"Go","package":"github.com/babylonlabs-io/finality-provider","versions":["1.1.0-rc.1"]},{"source":"osv","ecosystem":"Go","package":"github.com/babylonlabs-io/finality-provider","versions":["1.99.0-devnet.6"]},{"source":"osv","ecosystem":"Go","package":"github.com/babylonlabs-io/finality-provider","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"references":[{"url":"https://github.com/babylonlabs-io/finality-provider/security/advisories/GHSA-4jmp-x7mh-rgmr","tags":["web","advisory"]},{"url":"https://github.com/babylonlabs-io/finality-provider/commit/721bf5b7a271ada1679a67496c9bc3516c339390","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-4jmp-x7mh-rgmr"},{"url":"https://github.com/babylonlabs-io/finality-provider","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-4jmp-x7mh-rgmr","title":"Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration","description":"### Summary\n\nThe anti-slashing is not effective if the attacker can access EOTS manager endpoints.\n\n### Impact\n\nIf the EOTS manager endpoints are open to public without HMAC protection, the attacker can manually cause slashing of the finality provider through the RPC endpoints.\n\nReport credits go to: x.com/RebelsRunways","status":"published","published":"2025-12-12T20:15:03Z","modified":"2026-01-22T16:10:28Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:39:19.525691Z"}],"osv":[{"id":"GHSA-4jmp-x7mh-rgmr","title":"Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration","description":"### Summary\n\nThe anti-slashing is not effective if the attacker can access EOTS manager endpoints.\n\n### Impact\n\nIf the EOTS manager endpoints are open to public without HMAC protection, the attacker can manually cause slashing of the finality provider through the RPC endpoints.\n\nReport credits go to: x.com/RebelsRunways","status":"published","published":"2025-12-12T20:15:03Z","modified":"2026-02-03T03:11:20.351706Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"GO-2025-4236","title":"Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration in github.com/babylonlabs-io/finality-provider","description":"Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration in github.com/babylonlabs-io/finality-provider","status":"published","published":"2025-12-15T20:15:46Z","modified":"2026-03-03T04:57:48.025781Z","updated_at":"2026-11-02T15:47:02.011123Z"}]}}