github.com/babylonlabs-io/babylon/v3

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

Medium —

GHSA-4rmq-mc2c-r495

Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond

### Summary A state consistency bug in `x/costaking` can leave a BTC delegator with non-zero `ActiveSatoshis` (Phatom Stake) even after they have fully unbonded their BTC delegation, if their Finality Provider (FP) drops out of the active set in the exact sam…

github.com/babylonlabs-io/babylon github.com/babylonlabs-io/babylon/v2 github.com/babylonlabs-io/babylon/v3 github.com/babylonlabs-io/babylon/v4 Go

Dec 9, 2025
Medium —

GHSA-xq4h-wqm2-668w

Babylon's BIP322 signature implementation is not fully compliant to the spec

### Summary The BIP-322 signature verification does not enforce the SIGHASH value to be SIGHASH_ALL, and therefore is not strictly following the [spec](https://bips.dev/322/). ### Impact Non-compliant BIP-322 signatures in proof of possessions can be accepted…

github.com/babylonlabs-io/babylon github.com/babylonlabs-io/babylon/v2 github.com/babylonlabs-io/babylon/v3 github.com/babylonlabs-io/babylon/v4 Go

Nov 24, 2025