Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Summary A state consistency bug in `x/costaking` can leave a BTC delegator with non-zero `ActiveSatoshis` (Phatom Stake) even after they have fully unbonded their BTC delegation, if their Finality Provider (FP) drops out of the active set in the exact same babylon block height. This creates a “phantom stake”: the delegator’s BTC capital is withdrawn, the FP is inactive, but costaking continues to treat the delegation as active BTC stake allowing ongoing rewards accrual without backing BTC. ### Impact An address can keep earning costaking rewards with zero BTC staked. Reported by @BottyBott.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | github.com/babylonlabs-io/babylon/v4 (Go) | before 4.2.0 | 4.2.0 | Patch available | GHSA-4rmq-mc2c-r495 |
| — | github.com/babylonlabs-io/babylon/v3 (Go) | up to 3.0.0-snapshot.250805a | — | No fix listed | GHSA-4rmq-mc2c-r495 |
| — | github.com/babylonlabs-io/babylon/v2 (Go) | up to 2.3.2 | — | No fix listed | GHSA-4rmq-mc2c-r495 |
| — | github.com/babylonlabs-io/babylon (Go) | up to 1.1.0 | — | No fix listed | GHSA-4rmq-mc2c-r495 |
- github.com/babylonlabs-io/babylon/v4 (Go) Vendor— Affected before 4.2.0 Fixed in 4.2.0 Patch available GHSA-4rmq-mc2c-r495
- github.com/babylonlabs-io/babylon/v3 (Go) Vendor— Affected up to 3.0.0-snapshot.250805a Fixed in — No fix listed GHSA-4rmq-mc2c-r495
- github.com/babylonlabs-io/babylon/v2 (Go) Vendor— Affected up to 2.3.2 Fixed in — No fix listed GHSA-4rmq-mc2c-r495
- github.com/babylonlabs-io/babylon (Go) Vendor— Affected up to 1.1.0 Fixed in — No fix listed GHSA-4rmq-mc2c-r495
Remediation
- Fix · GHSA-4rmq-mc2c-r495 github.com/babylonlabs-io/babylon/v4 (Go) Fixed in 4.2.0 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-4rmq-mc2c-r495
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences