GHSA-4rmq-mc2c-r495: Github.com/babylonlabs io/babylon/v4 Babylon Incorrect FP Inactive Accounting Vulnerability
MODERATEGHSA-4rmq-mc2c-r495 is a MODERATE babylon incorrect fp inactive accounting vulnerability (CWE-459: Incomplete Cleanup) affecting Github.com/babylonlabs io/babylon/v4 libraries in the Go ecosystem. The issue involves babylon incorrect fp inactive accounting in costaking creates “phantom stake” that earns rewards after btc unbond. Remediation is available by upgrading affected packages to version 4.2.0.
GHSA-4rmq-mc2c-r495 at a Glance
How to Fix GHSA-4rmq-mc2c-r495
To remediate this vulnerability, upgrade all affected Github.com/babylonlabs io/babylon/v4 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/babylonlabs-io/babylon/v4 to 4.2.0Upgrade github.com/babylonlabs-io/babylon/v3 to Latest secure releaseUpgrade github.com/babylonlabs-io/babylon/v2 to Latest secure releaseUpgrade github.com/babylonlabs-io/babylon to Latest secure releaseRun the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/babylonlabs-io/babylon/v4How to Check if You Are Affected
To determine whether your application is affected by GHSA-4rmq-mc2c-r495, inspect your project dependencies for Github.com/babylonlabs io/babylon/v4:
inspect dependencies for github.com/babylonlabs-io/babylon/v4Analyze the terminal output to locate any version of Github.com/babylonlabs io/babylon/v4 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.2.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-459: Incomplete Cleanup, where the product does not properly "clean up" and remove temporary or supporting resources after they have been used. In Github.com/babylonlabs io/babylon/v4, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-4rmq-mc2c-r495 Affected Github.com/babylonlabs io/babylon/v4 Versions
4 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/babylonlabs-io/babylon/v4
|
Go |
< 4.2.0
|
4.2.0
|
|
github.com/babylonlabs-io/babylon/v3
|
Go |
≤ 3.0.0-snapshot.250805a
|
|
|
github.com/babylonlabs-io/babylon/v2
|
Go |
≤ 2.3.2
|
|
|
github.com/babylonlabs-io/babylon
|
Go |
≤ 1.1.0
|
|
References
Frequently Asked Questions
What is GHSA-4rmq-mc2c-r495?
Which Github.com/babylonlabs io/babylon/v4 versions are affected?
What version fixes GHSA-4rmq-mc2c-r495?
Is github.com/babylonlabs-io/babylon/v4 affected?
Is github.com/babylonlabs-io/babylon/v3 affected?
What CWE is associated with GHSA-4rmq-mc2c-r495?
How can I check Go dependencies for GHSA-4rmq-mc2c-r495?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-4rmq-mc2c-r495",
"modified" : "2025-12-09T14:25:03Z",
"published" : "2025-12-09T14:25:03Z",
"aliases" : [ ],
"summary" : "Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond",
"details" : "### Summary\n\nA state consistency bug in `x/costaking` can leave a BTC delegator with non-zero `ActiveSatoshis` (Phatom Stake) even after they have fully unbonded their BTC delegation, if their Finality Provider (FP) drops out of the active set in the exact same babylon block height. This creates a “phantom stake”: the delegator’s BTC capital is withdrawn, the FP is inactive, but costaking continues to treat the delegation as active BTC stake allowing ongoing rewards accrual without backing BTC.\n\n### Impact\n\nAn address can keep earning costaking rewards with zero BTC staked.\n\nReported by @BottyBott.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/babylonlabs-io/babylon/v4"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "4.2.0"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/babylonlabs-io/babylon/v3"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "3.0.0-snapshot.250805a"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/babylonlabs-io/babylon/v2"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "2.3.2"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/babylonlabs-io/babylon"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "1.1.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/babylonlabs-io/babylon/security/advisories/GHSA-4rmq-mc2c-r495"
}, {
"type" : "WEB",
"url" : "https://github.com/babylonlabs-io/babylon/commit/e65c3a55a398a403103f1b089cf76f0d4befc7a0"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/babylonlabs-io/babylon"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-459" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2025-12-09T14:25:03Z",
"nvd_published_at" : null
}
}