GitHub Advisoryadvisory · Go

GHSA-4jmp-x7mh-rgmr Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration

HIGH Published 2025-12-12 Modified 2026-01-22 Official page ↗
Ecosystem
Go
Packages
github.com/babylonlabs-io/finality-provider
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-285
Reviewed
2025-12-12

Affected packages

• Go github.com/babylonlabs-io/finality-provider: < 1.0.4 → fixed in 1.0.4 • Go github.com/babylonlabs-io/finality-provider: 1.1.0-rc.0 (no fix yet) • Go github.com/babylonlabs-io/finality-provider: 1.1.0-rc.1 (no fix yet) • Go github.com/babylonlabs-io/finality-provider: 1.99.0-devnet.6 (no fix yet)

Description

Summary The anti-slashing is not effective if the attacker can access EOTS manager endpoints. Impact If the EOTS manager endpoints are open to public without HMAC protection, the attacker can manually cause slashing of the finality provider through the RPC endpoints. Report credits go to: x.com/RebelsRunways

Related

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References