Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ GHSA-869w-47c6-fq8q — babylon

🟠 CVSS 8.0 — High ✅ No Known Exploit CWE-190 OSV
8.0
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt

Summary

Minting large amount of tokens through ibc transfer and then depositing them in validator rewards pool (via DepositValidatorRewardsPool message) can lead to integer overflow panic when calculating cumulative_reward_ratio for the validator.

This calculation happens in x/epoching module EndBlocker, thus the panic will halt the chain.

Impact

Denial of Service - Due to panic in the EndBlocker Babylon Genesis will halt

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. Rated impact: confidentiality none, integrity none, availability high.

Weakness class

GHSA-869w-47c6-fq8q is classified as CWE-190: Integer Overflow or Wraparound. Arithmetic produces a value too large for its type and wraps around, so a later size or bounds check passes when it should not.

Affected software

GHSA-869w-47c6-fq8q is recorded against 1 package.

  • github.com/babylonlabs-io/babylon

Timeline and source

Published on 15 May 2025 and last revised on 22 May 2025. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

github.com (Web)
github.com (Web)
github.com (Package)
pkg.go.dev (Web)

Details

Severity HIGH
CVSS Score 8.0
CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CWE CWE-190
Public Exploit ✅ No
Source OSV
Published 2025-05-15
Updated 2026-08-20
Modified 2025-05-22
Fix URL N/A

Affected Packages

Software From version Fixed in
github.com/babylonlabs-io/babylon — —

Similar Threats

Site Security Check

Is babylon part of your stack?

GHSA-869w-47c6-fq8q is rated CVSS 8.0 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.