GHSA-m6wq-66p2-c8pc Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers

• Go github.com/babylonlabs-io/babylon/v4: < 4.2.0 → fixed in 4.2.0 • Go github.com/babylonlabs-io/babylon/v3: <= 3.0.0-snapshot.250805a (no fix yet) • Go github.com/babylonlabs-io/babylon/v2: <= 2.3.2 (no fix yet) • Go github.com/babylonlabs-io/babylon: <= 1.1.0 (no fix yet)

Summary A vulnerability exists in Babylon’s BLS vote extension processing where a malicious active validator can submit a VoteExtension with the `block_hash` field omitted from the protobuf serialization. Because protobuf fields are optional, unmarshalling succeeds but leaves `BlockHash` as nil. Babylon then dereferences this nil pointer in consensus-critical code paths (notably `VerifyVoteExtension`, and also proposal-time vote verification), causing a runtime panic. Impact Intermittent validator crashes at epoch boundaries, which would slow down the creation of the epoch boundary block. Finder Vulnerability discovered by: • @GrumpyLaurie55348