PT-2025-62939 · Go · Github.Com/Babylonlabs-Io/Babylon+3

Publicado

2025-12-09

·

Atualizado

2025-12-09

CVSS v4.0

6.9

Média

VetorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

A state consistency bug in x/costaking can leave a BTC delegator with non-zero ActiveSatoshis (Phatom Stake) even after they have fully unbonded their BTC delegation, if their Finality Provider (FP) drops out of the active set in the exact same babylon block height. This creates a “phantom stake”: the delegator’s BTC capital is withdrawn, the FP is inactive, but costaking continues to treat the delegation as active BTC stake allowing ongoing rewards accrual without backing BTC.

Impact

An address can keep earning costaking rewards with zero BTC staked.
Reported by @BottyBott.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Enumeração de Fraquezas

Identificadores relacionados

GHSA-4RMQ-MC2C-R495

Produtos afetados

Github.Com/Babylonlabs-Io/Babylon
Github.Com/Babylonlabs-Io/Babylon/V2
Github.Com/Babylonlabs-Io/Babylon/V3
Github.Com/Babylonlabs-Io/Babylon/V4