GO-2025-4214
NoneCVSS
—
EPSS
—
Published
Dec 15, 2025
CISA due date
—
The record
Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond in github.com/babylonlabs-io/babylon
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/babylonlabs-io/babylon | 0 | No fix |
| Go | github.com/babylonlabs-io/babylon/v2 | 0 | No fix |
| Go | github.com/babylonlabs-io/babylon/v3 | 0 | No fix |
| Go | github.com/babylonlabs-io/babylon/v4 | 0 | 4.2.0 |
Related vulnerabilities
- GO-2025-4211 Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers in… Also affects github.com/babylonlabs-io/babylon
- GO-2025-4157 Babylon's malformed vote extensions are not rejected in github.com/babylonlabs-io/babylon Also affects github.com/babylonlabs-io/babylon
- GO-2025-4159 Babylon's BIP322 signature implementation is not fully compliant to the spec in… Also affects github.com/babylonlabs-io/babylon