Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt

published 2025-05-15 last yr. modified 2026-03-03 8mo ago also GO-2025-3687

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Summary Minting large amount of tokens through ibc transfer and then depositing them in validator rewards pool (via `DepositValidatorRewardsPool` message) can lead to integer overflow panic when calculating `cumulative_reward_ratio` for the validator.

This calculation happens in `x/epoching` module `EndBlocker`, thus the panic will halt the chain.

### Impact

Denial of Service - Due to panic in the `EndBlocker` Babylon Genesis will halt

Patch / fix

fixed in 1 links 1

go github.com/babylonlabs-io/babylon 1.1.0

github.com/babylonlabs-io/babylon@f0a29d6 commit

Is GHSA-869w-47c6-fq8q in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
go	github.com/babylonlabs-io/babylon	<1.1.0 all versions	1.1.0

Classification

Weakness

CWE-190 Integer Overflow or Wraparound
CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

GitHub Advisory GHSA-869w-47c6-fq8q
OSV GO-2025-3687

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.