Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/babylonlabs-io/babylon/v2

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.9GoPublished

    Babylon vulnerable to chain halt when a message modifies the validator set at the epoch boundary

    GHSA-rj53-j6jw-7f7g

    Affected
    • Go github.com/babylonlabs-io/babylon/v2 >= 2.0.0, < 2.1.0
    Fixed in
    2.1.0· Vendor fix available
    Issue
    Sending a message that modifies the validator set at the epoch boundary halts the chain. Impact Denial of Service - Comos-sdk prevents modifying the validator set from two different modules - https://github.com/cosmos/cosmos-sdk/blob/release/v0.50.x/types/module/module.go#L811. Such an operation leads to panic and chain halt. Detailed Post mortem https://boiling-lake-106.notion.site/2025-06-18-Genesis-mainnet-chain-halt-post-mortem-229f60cc1b5f80b7adf5e3ea0541ea87

    Recommended action: Upgrade to 2.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →