Junglewise Threat Intelligence
Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond
Severity: medium · CVSS 4 · Published 2025-12-09
Technologies: github.com/babylonlabs-io/babylon/v4 (Go), github.com/babylonlabs-io/babylon/v3 (Go), github.com/babylonlabs-io/babylon/v2 (Go), github.com/babylonlabs-io/babylon (Go). Vendors: Go.
Executive brief
Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond
Affected products
- Go github.com/babylonlabs-io/babylon/v4
- Go github.com/babylonlabs-io/babylon/v3
- Go github.com/babylonlabs-io/babylon/v2
- Go github.com/babylonlabs-io/babylon