GitHub Advisoryadvisory · Go

GHSA-4rmq-mc2c-r495 Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond

MEDIUM Published 2025-12-09 Modified 2025-12-09 Official page ↗
Ecosystem
Go
Packages
github.com/babylonlabs-io/babylon/v4, github.com/babylonlabs-io/babylon/v3, github.com/babylonlabs-io/babylon/v2, github.com/babylonlabs-io/babylon
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-459
Reviewed
2025-12-09

Affected packages

• Go github.com/babylonlabs-io/babylon/v4: < 4.2.0 → fixed in 4.2.0 • Go github.com/babylonlabs-io/babylon/v3: <= 3.0.0-snapshot.250805a (no fix yet) • Go github.com/babylonlabs-io/babylon/v2: <= 2.3.2 (no fix yet) • Go github.com/babylonlabs-io/babylon: <= 1.1.0 (no fix yet)

Description

Summary A state consistency bug in `x/costaking` can leave a BTC delegator with non-zero `ActiveSatoshis` (Phatom Stake) even after they have fully unbonded their BTC delegation, if their Finality Provider (FP) drops out of the active set in the exact same babylon block height. This creates a “phantom stake”: the delegator’s BTC capital is withdrawn, the FP is inactive, but costaking continues to treat the delegation as active BTC stake allowing ongoing rewards accrual without backing BTC. Impact An address can keep earning costaking rewards with zero BTC staked. Reported by @BottyBott.

Related

Weakness · CWE (1)

  • CWE-459 Incomplete Cleanup weakness

References